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In this Reply we propose a modified security proof of the Quantum Dense Key Distribution 
protocol detecting also the eavesdropping attack proposed by Wojcik in his Comment. 

PACS numbers: 03.67.Hk, 03.65.Ud 



In his Comment 0, Wojcik proposes two simple 
schemes for performing eavesdropping attacks to the 
Quantum Dense Key Distribution protocol (QDKD) in 
Ref. Q. These schemes enable Eve to achieve a larger 
mutual information than Alice's and Bob's one, but 
maintaining inviolated the security condition (Eq. (6) 
in Ref. 0). 

Eve's attack in Wqjcik's schemes relies on the possibil- 
ity of subtraction of photons from the quantum channel 
without being disclosed by the Anticorrelation Check. In 
fact the security proof given in is incomplete because 
it includes only the effect that Eve's presence induces a 
bit flip on the travelling qubit. 

In this reply we complete the security proof of QDKD 
even against individual eavesdropping attack with injec- 
tion or subtraction of photons in the quantum channels. 
Furthermore we discuss the security of the experimen- 
tal realization of the QDKD protocol performed in 0, 
according to the arguments raised by the modified proof. 

A dedicated formalism is introduced to account for 
these attacks. Let |m x ) be the state with n photons on 
the quantum channel X, where m photons have horizon- 
tal polarization and (n — m) vertical polarization. The 
orthonormal base £>x : {|"^x)} s P ans the Hilbert space 
Hx of photons in channel X; |0x) is the vacuum state. 

In the actual formalism, referring to Fig. 1 in Ref. 
@, Alice produces pairs of photons in the singlet state 
HAab) = Tad ! 1 !}) - |1a°b))- Photon A is stored in her 
laboratory while on photon B she performs either the op- 
eration 1b (identity operator) or Zb before sending it to 
Bob. A generalized gate Zb acts in the Hilbert space Hb 
as ZB|mg) = (— l) m |mg). Zb is hermitian and unitary, 
and corresponds to the Pauli matrix az acting individu- 
ally on each photon in the channel B. Alice's selection of 
gate 1b or Zb is encoded according to 



1b|V>ab) = IV'ab) — > bit 
^bIV'ab) = -Wkb) — > bit !> 



(1) 



with |^+ B ) = ^=(]0il^> + |1 A B )). 

Bob randomly switches photon B towards either the 
Anticorrelation Check or his encoding apparatus. 

The Anticorrelation Check is performed by Bob pro- 
jecting photon B on the states |0g) and |lg) and Alice 
projecting photon A on the states and |0\), re- 

spectively. The non-local measurement guarantees the 
security of the transmission. 

Bob's encoding apparatus is identical to Alice's. The 
communication takes place sending back photon B to Al- 
ice, who performs the incomplete Bell's state analysis. 
Specifically, |Vab) corresponds to Alice and Bob encod- 
ing and 1 or 1 and respectively, while IVab) corre- 
sponds to Alice and Bob both encoding or 1. In other 
words the measurement of |Vab)> IVab) corresponds to 
the sum mod 2 of the bits encoded by Alice and Bob. 

We model the general individual Eve's attack by cou- 
pling photon B with an ancilla system of Hilbert space 
He in the initial state |ce) by means of general unitary 
operators Jbe and Kbe before and after Bob's opera- 
tions, respectively. The final state belongs to the widened 
Hilbert space Ha <B> Hb ® We- This approach is general 
because any physical non-unitary interaction is equiva- 
lent to a unitary one with a higher dimensional ancilla 
space Q. 

The final state after Bob's and Eve's operations is de- 
scribed by the trace preserving quantum operation £ 
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where £g and £ lB are quantum operations describing 
the evolution of the initial state /Sab prepared by Alice 
and modified by Bob's and Eve's actions 

£i b (PAb) = -f^BElB JBEpAB ® |eE)(eE|^BE 1 B^BE' 

£ Zb {pab) = KbeZbJbePab ® |eE)(eE| ^be-^b-^ B e( 3 ) 

It is assumed that Bob encodes bit or 1 with probability 
1/2- 

Our aim is to quantify the maximum information 
achievable by Eve in terms of the quantities measured 



2 



by Alice and Bob in the Anticorrelation Check. We de- 
fine the quantities Poi and Pio as the probabilities of 
anticorrelated results according to 

P 1 = tr[J B EpAB <S> |e E )(e E |.7BE n oi], 

Pio = tr[J B EPAB ® |e E )(e E |^ E IIio] ) (4) 

where n 01 = 1 0\ 1 ^ > <0\ 1 ^ | , fi 10 = are pro- 

jection operators. We assume /?ab = 1 /2|'0ab)(' ! / , abI + 
1/2|V'ab)(^'abI (Alice prepares only states IV'ab) w ^ n 
probability ¥), in the absence of Eve's attack Poi = 
Pio = 0.5 (perfect anticorrelation). Eve's actions lower 
the value of Poi and Pio and this is basically the signa- 
ture of her presence. 

The maximum of the mutual information between Bob 
and Eve Ib:E, he. Eve's ability to distinguish Bob's op- 
erations, can be evaluated exploiting the Holevo bound 
0: Ib-.e < Ib-.e- Consider the following scenario: Alice 
prepares the state /?ab, Bob encodes his key, and Eve 
couples her system to photon B. The maximum mutual 
information between Bob and Eve / B: e is bounded by 

2b:E = S[£(pab)} - ^S[£i b (pab)] - ^S[£^ b (pab)}, (5) 

where S(p) is the Von Neumann entropy Q of the generic 
state p. 

Analogously, also the maximum of mutual information 
between Alice and Eve Ia-.e, i-e. Eve's ability to distin- 
guish the states prepared by Alice, is calculated exploit- 
ing the Holevo bound (Ia:E < 2"a:e)- In this case 

Z A :E = S[£(p AB )]-~S[£ (|^Xb>^IbI)]-5^(|V1b>(^ e 

To evaluate 2a.:E and 2b:E in terms of Poi and Pio we 
define the final states in the coupled space TLa®'Hb®'He, 
after Bob's and Eve's operations 

-^beIb^beIV'ab) ® l e E) = IMabe)' 

-^beIbJbeIV'ab) ® |eE) = Imabe)) 

Kbe-^bJbeIV'ab) ® l e E) = I^abe)' 

K be Z b J be \i(;^ b ) <g> |e E ) = I^abe)' ( 7 ) 

where we observe that (^abe^ase) = °> (^abeI^abe) = 
0. 

Before the Anticorrelation Check (or the Bob's opera- 
tion) the evolution of the system can be completely de- 
scribed by Eve's operation of coupling photon B with her 
ancilla system 

Jbe|1 b ) ® l e E) = a|l^) ® |a E ) +7|r B E), 
JB E |0^)®|e E ) = /3|0 B )<8 |/3e)+<S|A B e>, (8) 

with (l B |r BE ) - and (0 B |A BE ) = 0. \a E ), \ \T BE ), 
A B e) arc normalized to one and the operator J B e is uni- 
tary thus H 2 + |7| 2 = \(3\ 2 + \i)\ 2 = 1. The states |r BE ) 




FIG. 1: Plot of the maximum of 2b:E (a) and Xa:E (b) versus 
Poi and Pio 

and | Abe) represent situations in which the Anticorre- 
lation Check produces unexpected (" wrong" ) results due 
to e.g. bit-flip, vacuum state or state with more than one 
photon in the channel B. This is the main difference with 
respect to the security proof proposed in |2j where Alice 
and Bob considered that only the bit-flip was the signa- 
ture of Eve's presence. In this respect the probabilities of 
anticorrelated results are Poi = |a| 2 /2 and Pio = \f3\ 2 /2. 

Thus, we can obtain the relation between Poi and Pio, 
and the final states of the coupled system, by inserting 
Eq.s © in the left hand side of Eq.s Q. Observing 

that (MabeI^abe) = (PabeI^abe) = Pi W.beI^abe) = 
• WbeI^abe) - 1 wc obtain 

P=^-Poi(l + c)-Pio(l-d), 

«=^-Poi(l + c) + Pio(l-d). ( 9 ) 

where c = (Pbe|-^b|Pbe) and d = (A B e|Z b |A B e) are two 
real parameters (c and d G [—1,1]) under Eve's control 
that cannot be evaluated by Alice and Bob |5j. 

According to Eq. (J5J, we evaluate Zb:E- From 
Eq.s © and Eq.s we obtain S[£% B (pab)} = 1, 
S[£g (pab)] = 1- The calculation of S[£(pab)] is not 
trivial. In order to obtain the diagonal representation 
of the state £(pab) we introduce the orthonormal base 

S : {IMabe)> IMabe>> I^abe) ' ld 2 BE>}- S s P ans the generic 
subspace of the Hilbert space Ha ® H B ® We support of 
£{pab)- According to Eq.s ©, the states I^abe) ano ^ 
I^abe) can rje rewritten as 

Kbe) = pI/4be) + ^IMabe) + s ICabe) + ^I^abe) ' 

I^abe) = <?Ia4be) + pIm A be) + r ld 1 BE>> 

where r, s and t are complex, and p and g, according 
with Eq. JJjJ, are real. From the normalization and or- 
thogonality conditions on I^abe) and I^abe) we obtain 
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the Von Neumann entropy of £(pab) as 

4 

S[£(p AB )] = -Y,Wog\ i . (10) 

i=i 

where Ai = \{l-p-q), A 2 = i(l+p+q), A 3 = \(l-p+q) 
and A4 = ^(1 + p — q). Thus, 

4 

lB:E=-5^XilogAi-l. (11) 

i=l 

As Alice and Bob have only access to the results of the 
Anticorrelation Check, for any fixed pair of values P01 
and P10 the maximum information achievable by Eve, 
max Cj( j{ZB:E}, corresponds to the maximum value of Xb-.e 
in the range of values allowed for c and d. As shown in 
Fig. 1 (a) the behavior of max c>c ({2B:E} versus P01 and 
P10 can be analyzed by considering four regions. Specif- 
ically 

• for P01 > 0.25 and P 10 > 0.25 

max C:d {X B: E} = 2b:e(Poi,Pio,c = l,d= -1) 

• for P i < 0.25 and P 10 > 0.25 

max C)d {J B:E } = ^B:e(Poi,Pio,c = 1 ^p ol , d = -1) 

• for P i > 0.25 and P 10 < 0.25 

max Cirf {J B :E} = Ib:e(Poi,Pio,c = l,d= 2 p^-i )) 

• for P i < 0.25 and P 10 < 0.25 

max Ci d{J B:E } = 1. 

Thus, for P01 > 0.25 or P10 > 0.25 the maximum in- 
formation achievable by Eve is upper-bounded, and for 
P01 = P10 = 0.5 (perfect anticorrelation) Eve can get no 
information at all. 

According to Eq. 10, we evaluate Xa-.e- Observ- 
ing that the eigenvalues of both £(|V'ab)(V'abI) ano - 
£(IV>ab>^abI) ar e AJ = |(1 - q) and A 2 = |(1 + q), 
we obtain 

2 4 

»=i j=i 

As previously, Alice and Bob has only access to P01 and 
P10, thus we evaluate max Cj£ ;{2A:E}, the maximum value 
of 2a:E hi the range of c and d allowed values. 

In Fig. 1 (b) max Cj( j{2A:E} is plotted versus P01 and 
P10 where only two regions are identified. 

• For P01 + P10 > 0.5 

max C:d {X A: E} =2"a:e(Poi,Pio,c= l,d = -1) 

• for P01 +P10 < 0.5 
max Cirf {X A :E} = 1. 

Note that the maximum information achievable by 
Eve is upper-bounded only if P i + P10 > 0.5, but 
also in this case Eve cannot gain any information for 



P01 = P10 = 0.5. It is straightforward to demon- 
strate that max C:ti {lA(B):E}(Poi = V,Pw = V) > 
max Cjti {lA(B):E}(Poi = V - k, P 10 = V + k) with -V < 
k < V . Despite the different shapes of the two sur- 
faces in Fig. 1, for any values of V, we observe that 
max Cjd {2" A :E}(Poi = V,Pw =V) = max Cjd {X B: E}(Poi = 
V,P W =V) = H(l - TP) for 0.25 < V < 0.5, while 
max Cid {2A:E}(Poi = P,Pio =V) = max Cjd {J B:E }(P i = 
V, P10 = V) = 1 for < V < 0.25 where H is the Shan- 
non entropy of a binary channel . 

In summary, the maximum information achievable by 
Eve is upper-bounded in some region, even when Eve can 
modify the number of photons in the quantum channel. 
Moreover these upper bounds have been demonstrated 
to be strictly related to the Anticorrelation Check out- 
comes. Thus measurement of P01, P10 would allow Alice 
and Bob to determine the security level of the communi- 
cation. In addition we point out that, as in |2|, Eve's re- 
sources have been heavily overestimated in deriving Eq.s 
(|11[> and l|12l) . In order to extract information on Alice 
and Bob operations, we assumed that Eve should per- 
form any POVM on the final state of the whole space 
'Ha®'Hb®'He as clearly stated in Eq.s JSJ and (JBJ. This 
is obviously not the case. Even if Eve can perform any 
POVM on the final state of her ancilla system, about the 
Alice-Bob system, she can only know the results disclosed 
during the public discussion. This induces to think that 
information achievable by Eve should be in some cases 
well below these limits. 

As already pointed out in 0, Alice's and Bob's are able 
to recover secure cryptographic keys in spite of Eve's at- 
tack if the condition Ia.b > Ia-.e. and Jab > ^B:E is sat- 
isfied 0, where /a:B is the mutual information between 
Alice and Bob (Ref. demonstrates that this condition 
is, in some cases, too restrictive). Ia.b can be simply 
calculated considering the capacity of a noisy channel of 
quantum bit error rate Q, as Ja : b = 1 — H(Q) 0. To 
ensure the security of the two generated keys, we replace 
7a:E and 7 B:E with max Cid {J A: E} and max c , (i {Z B: E} cal- 
culated for P01 = P10 = V. This means that Alice and 
Bob can distill common secret keys when 0.25 < V < 0.5 
and 

H(Q) + H(1-2V) < 1. (13) 

Despite the fact that Eq. p3|) appears to be formally 
analogous to Eq. (6) in [2j, we underline that in Eq. 
(Q3J) the term V (V ~ Pol + Pl ° ) should be carefully eval- 
uated from the experimental data as the ratio between 
the anticorrelated results and all possible results (anti- 
correlated and "wrong") of the Anticorrelation Check. 
The results of the Anticorrelation Check should be con- 
sidered "wrong" not only in the case of correlated re- 
sults, but also if more than two photon are detected in 
coincidence by the Alice and Bob apparatuses, or if only 
one of Alice's detector fires. This last case makes the 
QDKD protocol not practical for today technology as all 
the transmission losses and detection inefficiencies would 
be considered due to eavesdropping attack. 
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Let us consider, as an example, the experimental real- 
ization of QDKD protocol performed in Q. Losses due 
to the detection apparatuses (which is the main contri- 
bution) as well as to the source and to the encoder ap- 
paratuses strongly affect the estimation of the parameter 
V. In fact, the probability of losing one photon of the 
pair by the generation-detection apparatuses was esti- 
mated to be Pioss — 0.77, and we observed a probability 
of correlated results P cor r < 0.05 due to optics imper- 
fections, misalignment and dark counts. The probabil- 
ity of measuring a three-fold or four-fold coincidences 
due to the presence of more than a photon pair in the 
quantum channels or to dark counts was completely neg- 
ligible. Also losses in the quantum channels are com- 
pletely negligible (propagation in air for less than one 
meter). Thus the anticorrelation parameter V is evalu- 
ated as V = (1 — Pioss — Pcorr) /2 — 0.09, and, according 
to the considerations related to Eq. (| 1 31) , common secret 
keys cannot be distilled. 

But if we assume that Eve cannot modify Alice and 
Bob detection apparatuses as she has not access to their 
laboratories, the detection inefficiencies can be traced out 
in the evaluation of V, and we could implement secure 
QDKD protocols for short distances and in low noise en- 
vironment. In particular, in the case of the experimental 
implementation of Ref. 0] the anticorrelation parameter 
simply reduces to V = (1 — P CO rr)/2 — 0.47, and the 
secure keys distribution can be ascertained. 

In Ref.s @ and two protocols are proposed for uni- 
directional secure direct communication (message from 
Bob to Alice) based on local operations on one photon 
of an EPR pair. We observe that the QDKD scheme 
can be used to implement bidirectional secure determin- 
istic communication (either message from Alice to Bob 
or from Bob to Alice). 

When a deterministic message is sent from Bob to Al- 
ice, Alice encodes a random sequence of bits and Bob en- 
codes the deterministic message. As Alice is aware of her 
operations (1b or Zb), she can extract the message-bit 
encoded by Bob from the measurement result IV'ab) or 
IV'ab)- During the communication Bob discloses the re- 
sults obtained from his Anticorrelation Check apparatus 
on a non-jammable public channel, i.e. a public chan- 
nel that can be monitored but not modified by anybody 
else. According to these results as well as to her measure- 
ments, Alice estimates the security level of the on-going 



communication. If the communication is insecure, Alice 
and Bob decide to abort the transmission. A drawback 
of this protocol, as well as of the protocols in Ref.s @ 
and |9j , is that part of the secret message is in any case 
eavesdropped before the transmission is stopped. 

When a deterministic message is sent from Alice to 
Bob, Bob encodes a random sequence of bits (in some 
sense a cryptographic key), and Alice encodes the de- 
terministic message. The measurement of a sequence 
°f IV 7 ab)> IV'ab) corresponds to the Alice's message en- 
crypted by Bob's key. After the end of the quantum 
communication, Bob discloses the results obtained from 
his Anticorrelation Check apparatus on a non-jammable 
public channel. According to these results as well as to 
her measurements, Alice estimates the security level of 
the communication. If communication is secure, Alice 
discloses the results of her measurements corresponding 
to the message encrypted by Bob's key. Since Bob is 
aware of his key, he can extract the message encoded by 
Alice. Only if the security of the communication is as- 
certained the encrypted message is publicly disclosed by 
Alice, thus this protocol is not affected by the security 
drawback present in the communication from Bob to Al- 
ice and in protocols of Ref.s @ and 0. 

Furthermore in both protocols of Ref.s and the 
security proofs consider that Eve's presence only induces 
bit-flips and they do not consider eavesdropping strate- 
gies based on injection-subtraction of photons in the 
quantum channel. In fact a successful eavesdropping at- 
tack against protocol in Ref. Q based on subtraction 
of photons has already been proposed 0], while valid 
eavesdropping strategies have not yet been found against 
protocol of Ref. |j . We observe that for both these pro- 
tocols a security proof analogous to the one here proposed 
is necessary in order to guarantee the security against 
also the attacks based on injection-subtraction of pho- 
tons. 

In conclusion, this Reply proposes an improved secu- 
rity proof of the QDKD protocol which is able to de- 
tect any individual eavesdropping attack and to provide 
an upper bound to the information achievable by Eve, 
even in the case of attacks exploiting the possibility of 
injecting-subtracting photons in the quantum channel as 
the ones proposed in Wojcik's Comment 

The work was supported by MIUR (Project 67679) and 
by Elsag S.p.A. 
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